Essentially, VirtualAlloc is the equivalent of sbrk in other OS's, and allocates virtual pages to the process. If you can find out what's calling that all the time, you're likely to discover what's allocating memory.